Coldcard X account hacked: Fake security alert targets users

4.1 Security

Oct 11, 2026

Coldcard’s X account was hacked, posting a fake firmware alert and phishing link. The post was deleted; Coldcard found no internal breach, urged caution, and requested an investigation.

On October 11, 2026, Coldcard’s official X (formerly Twitter) account was compromised. Attackers posted a fake security alert, falsely claiming critical firmware vulnerabilities in the Mk4, Mk5, and Q hardware wallet models. Users were urged to transfer their assets to a phishing website. The malicious post was swiftly deleted, and Coldcard promptly warned users not to click the link. This phishing attempt was especially convincing due to a previous incident in July, when a firmware vulnerability led to losses of 1,600–1,800 BTC ($100–130 million). Coldcard reported no unauthorized access or suspicious sessions in their records, confirming that credentials and offline two-factor authentication remained secure. The company suspects unauthorized access at the platform or administrator level, has requested an immediate investigation from X, and is reviewing account permissions. No evidence of internal system compromise was found, but Coldcard emphasized the risk of users mistaking the fake alert for a legitimate update.